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DETAILED ACTION 

1. Claims 1-28 are pending 

Claim Rejections - 35 USC §112 

2. 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claim 6 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. In Claim 6, the phrase "grouping the on-demand anti-virus 
scan requests into chunks of multiple ones of the on-demand anti-virus scan requests" 
is unclear. The phrase can be interpreted as grouping the individual scan requests or 
grouping using chunks of multiple ones. Appropriate correction is required. 

Claim Rejections - 35 USC § 103 

3. 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 4 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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Claims 1-28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Edwards (7188367) in view of Novell's article: Antivirus Solutions for Network. 

Regarding Claims 1-3, 

Edwards teaches a method of operating a plurality of virus checkers, the method 
comprising: 

Distributing anti-virus scan requests from the virus scan request queue to the 
virus checkers. ("The scan requests are placed on the priority queue as they are received; the 
scanner threads can then select a suitable scan request from the priority queue based on the 
scan request's characteristics and the current state of the other scanner threads in the pool" 
Column 3, lines 19-23) 

Although Edwards does teach both on-demand and on-access virus scan 
requests ("Virus scanners may be invoked on-demand by a computer user to scan a selected 
file. More typically, virus scanners install themselves as part of an operating system and then 
scan files, according to user preferences, as the files are created and accessed. This type of 
virus scanner is referred to as an on-access virus scanned Column 1, lines 43-48), Edwards 
does not explicitly teach wherein the scan request queue has on-demand anti-virus 
scanning concurrent with on-access anti-virus scanning. 
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Novell teaches that "Command Anti-Virus with F-PROT Professional 4,52 for NetWare 
offers analysis, which includes both an on-access scanner and an on-demand scanner to 
search for polymorph addition, you can configure multiple concurrent scans (pg. 1)" 

It would have been obvious to one of ordinary skill in the art to combine the virus 
scan queue of Edwards to include concurrent on-access and on-demand scanners. 

The motivation to combine is that it is well known in the virus scanning art to 
have both on-demand and on-access scanners running concurrently. Novell provides 
an example of such a system. 

The Examiner interprets the "user to scan a selected file" from the Edwards 
reference as a system administrator requesting a scan of files. 



Regarding Claim 4, 

Edwards and Novell teach the method as claimed in claim 1 , wherein a pool of 
threads distribute the on-demand anti-virus scan requests and the on-access anti-virus 
scan requests from the virus scan request queue to the virus checkers, each anti-virus 
scan request on the virus scan request queue being serviced by a respective one of the 
threads in the pool of threads. ("The scanner thread determines whether the object of the 
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intercepted event. .needs scanning and, if so, scans the object Multiple scanner threads are 
typically provided in pools that are capable of executing concurrently" Column 2, lines 18-24) 

Regarding Claims 5-7, 

Edwards and Novell teach the method as claimed in claim 1 , wherein certain 
scan requests are given priority based on certain characteristics by not inhibiting a first 
kind of scan requests while inhibiting the placement of a second kind of scan requests 
based on a second group of characteristics when the number of anti-virus scan 
requests on the virus scan request queue reaches a threshold, ("a pending scan request 
from user A may be determined to be more suitable than a pending scan request from user B if 
three of the four scanner threads are already scanning scan requests from user B. This 
prevents a single user B from monopolizing the virus scanner (Column 5, lines 66-67, Column 
6, lines 1-3).") 

Edwards also teaches grouping individual scan requests into chunks based on 
characteristics, and placing the chunks onto the virus scan request queue. Edwards 
further teaches scanning one type of grouped scans until completion before scanning a 
second type ("the scan request is placed on the priority queue in... some other pre-defined 
fixed order, e.g. executable files first and data files second" Column 7, lines 33-34, Edwards). 
The Examiner interprets the fixed order as inherently requiring grouping different scan 
characteristics into groups or chunks. 



Application/Control Number: 10/748,008 
Art Unit: 2139 



Page 6 



However Edwards does not explicitly teach that on-access scan requests are 
given priority over the on-demand anti-virus scan requests by inhibiting placing on- 
demand scan requests into the scan request queue. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the method of Edwards to include the type of virus scan (on-access 
or on-demand) as "certain additional characteristics about scan requests." 

The motivation is the different types of scans are an important characteristic of 
scans, and as both on-access and on-demand virus scans each have their own 
benefits, it would be useful to prioritize based on their type. 

Edwards does not explicitly teach that the scan requests would be grouped into 
chunks are on-demand scan requests. 

It would have been obvious to ( one of ordinary skill in the art at the time of the 
invention to modify Edwards to group on-demand scan requests into chunks. 

The motivation is that Edwards already groups scan requests into chunks based 
on certain characteristics and the type of virus scan (on-demand or on-access) is a 
characteristic of a virus scan. 
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The Examiner interprets the original claim language "grouping the on-demand 
anti-virus scan requests into chunks of multiple ones of the on-demand anti-virus scan 
requests" as just "grouping individual on-demand requests into chunks." 

The Examiner further interprets inhibiting the placement of at least one of the 
chunks onto the virus scan request queue until completion of anti-virus scanning for the 
anti-virus scan requests in a prior one of the chunks as scanning one type of grouped 
scans until completion before scanning a second type. 

Regarding Claims 8-11, 

Edwards teaches a method of operating a plurality of virus checkers, the method 
comprising: 

Distributing anti-virus scan requests from the virus scan request queue to the 
virus checkers. ("The scan requests are placed on the priority queue as they are received; the 
scanner threads can then select a suitable scan request from the priority queue based on the 
scan request's characteristics and the current state of the other scanner threads in the pool" 
Column 3, lines 19-23) 

Edwards also teaches grouping individual scan requests into chunks, and placing 
the chunks onto the virus scan request queue. Edwards further teaches scanning one 
type of grouped scans until completion before scanning a second type ("the scan 
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request is placed on the priority queue in... some other pre-defined fixed order, e.g. executable 
files first and data files second" Column 7, lines 33-34, Edwards). The Examiner interprets 
the fixed order as inherently requiring grouping different scan characteristics into 
groups or chunks. 

Although Edwards does teach both on-demand and on-access virus scan 
requests ("Virus scanners may be invoked on-demand by a computer user to scan a selected 
file. More typically, virus scanners install themselves as part of an operating system and then 
scan files, according to user preferences, as the files are created and accessed. This type of 
virus scanner is referred to as an on-access virus scanner" Column i, lines 43-48), Edwards 
does not explicitly teach wherein the scan request queue has on-demand anti-virus 
scanning concurrent with. on-access anti-virus scanning. 

Novell teaches that "Command Anti-Virus with F-PROT Professional 4.52 for NetWare 
offers analysis, which includes both an on-access scanner and an on-demand scanner to 
search for polymorph addition, you can configure multiple concurrent scans (pg. 1)" 

It would have been obvious to one of ordinary skill in the art to combine the virus 
scan queue of Edwards to include concurrent on-access and on-demand scanners. 

The motivation to combine is that it is well known in the virus scanning art to 
have both on-demand and on-access scanners running concurrently. Novell provides 
an example of such a system. 
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The Examiner interprets the "user to scan a selected file" from the Edwards 
reference as a system administrator requesting a scan of files. 

Edwards does not explicitly teach that the scan requests would be grouped into 
chunks are on-demand scan requests. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Edwards to group on-demand scan requests into chunks. 

The motivation is that Edwards already groups scan requests into chunks based 
on certain characteristics and the type of virus scan (on-demand or on-access) is a 
characteristic of a virus scan. 

Regarding Claims 12-15, 

Edwards teaches a method of operating a plurality of virus checkers, the method 
comprising: 

A pool of threads distribute the on-demand anti-virus scan requests and the on- 
access anti-virus scan requests from the virus scan request queue to the virus 
checkers, each anti-virus scan request on the virus scan request queue being serviced 
by a respective one of the threads in the pool of threads. {"The scanner thread 
determines whether the object of the intercepted event., needs scanning and, if so, scans the 
object. Multiple scanner threads are typically provided in pools that are capable of executing 
concurrently" Column 2, lines 18-24) 
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Distributing anti-virus scan requests from the virus scan request queue to the 
virus checkers. (" The scan requests are placed on the priority queue as they are received; the 
scanner threads can then select a suitable scan request from the priority queue based on the 
scan request's characteristics and the current state of the other scanner threads in the pool" 
Column 3, lines 19-23) 

Edwards also teaches grouping individual scan requests into chunks, and placing 
the chunks onto the virus scan request queue. Edwards further teaches scanning one 
type of grouped scans until completion before scanning a second type ("the scan 
request is placed on the priority queue in., .some other pre-defined fixed order, e.g. executable 
files first and data files second" Column 7, lines 33-34, Edwards). The Examiner interprets 
the fixed order as inherently requiring grouping different scan characteristics into 
groups or chunks. 

Although Edwards does teach both on-demand and on-access virus scan 
requests ("Virus scanners may be invoked on-demand by a computer user to scan a selected 
file. More typically virus scanners install themselves as part of an operating system and then 

scan files, according to user preferences, as the files are created and accessed. This type of 

* 

virus scanner is referred to as an on-access virus scanner" Column 1, lines 43-48), Edwards 
does not explicitly teach wherein the scan request queue has on-demand anti-virus 
scanning concurrent with on-access anti-virus scanning. 
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Novell teaches that "Command Anti-Virus with F-PROT Professional 4.52 for NetWare 
offers analysis, which includes both an on-access scanner and an on-demand scanner to 
search for polymorph addition, you can configure multiple concurrent scans (pg. 1)" 

It would have been obvious to one of ordinary skill in the art to combine the virus 
scan queue of Edwards to include concurrent on-access and on-demand scanners. 

The motivation to combine is that it is well known in the virus scanning art to 
have both on-demand and on-access scanners running concurrently. Novell provides 
an example of such a system. 

The Examiner interprets the "user to scan a selected file" from the Edwards 
reference as a system administrator requesting a scan of files. 

Edwards does not explicitly teach that the scan requests would be grouped into 
chunks are on-demand scan requests. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Edwards to group on-demand scan requests into chunks. 

The motivation is that Edwards already groups scan requests into chunks based 
on certain characteristics and the type of virus scan (on-demand or on-access) is a 
characteristic of a virus scan. 
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The Examiner interprets the original claim language "grouping the on-demand 
anti-virus scan requests into chunks of multiple ones of the on-demand anti-virus scan 
requests" as just "grouping individual on-demand requests into chunks." 

The Examiner further interprets inhibiting the placement of at least one of the 
chunks onto the virus scan request queue until completion of anti-virus scanning for the 
anti-virus scan requests in a prior one of the chunks as scanning one type of grouped 
scans until completion before scanning a second type. 

Regarding Claim 16, 18-19 

Edwards teaches a virus checking system comprising: 
A plurality of virus checkers ("Virus scanners may be invoked on-demand by a 
computer user to scan a selected file. More typically, virus scanners install themselves as part 
of an operating system and then scan files, according to user preferences, as the files are 
created and accessed. This type of virus scanner is referred to as an on-access virus scanner"' 
Column 1, lines 43-48), 

A virus scan request queue (Fig. 2, Priority Queue)] 

A processor ("An exemplary system for implementing the invention includes... a 
processor (or processing unit)" Column 8, lines 37-45) coupled to the virus checkers and 
the virus scan request queue for sending virus scan requests from the virus scan 
request queue to the virus checkers ("prioritize the scan requests by placing them in the 
priority queue" Column 5, lines 40-42) ; 
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Distributing anti-virus scan requests from the virus scan request queue to the 
virus checkers. ("The scan requests are placed on the priority queue as they are received; the 
scanner threads can then select a suitable scan request from the priority queue based on the 
scan request's characteristics and the current state of the other scanner threads in the pool" 
Column 3, lines 19-23) 

Although Edwards does teach both on-demand and on-access virus scan 
requests ("Virus scanners may be invoked on-demand by a computer user to scan a selected 
file. More typically, virus scanners install themselves as part of an operating system and then 
scan files, according to user preferences, as the files are created and accessed. This type of 
virus scanner is referred to as an on-access virus scanner" Column 1, lines 43-48), Edwards 
does not explicitly teach wherein the scan request queue has on-demand anti-virus 
scanning concurrent with on-access anti-virus scanning. 

Novell teaches that "Command Anti-Virus with F-PROT Professional 4.52 for NetWare 
offers analysis, which includes both an on-access scanner and an on-demand scanner to 
search for polymorph addition, you can configure multiple concurrent scans (pg. 1)" 

It would have been obvious to one of ordinary skill in the art to combine the virus 
scan queue of Edwards to include concurrent on-access and on-demand scanners and 
then to distribute these scan requests to the virus checkers. 
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The motivation to combine is that it is well known in the virus scanning art to 
have both on-demand and on-access scanners running concurrently. Novell provides 
an example of such a system. 

The Examiner interprets the "user to scan a selected file" from the Edwards 
reference as a system administrator requesting a scan of files. 



Regarding Claim 17, 

Edwards and Novell teach the virus checking system as claimed in claim 16, 
wherein said at least one processor and said virus scan request queue are in a file 
server, and the virus checkers are separate from the file server, ("pre-processor threads 
obtain certain additional characteristics about the scan requests... In a client/server 
environment, the characteristics may further include whether the object is being accessed form 
the server console or from a network client" Column 5, lines 25-38) 

Because the pre-processor threads are in between the server and the processor, 
the Examiner interprets the virus checkers as being separate from the file server. 

Regarding Claim 20, 

Edwards and Novell teach the virus checking system as claimed in claim 16, 
wherein said at least one processor is programmed to execute multiple threads for 
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distributing the on-demand anti-virus scan requests and the on-access anti-virus scan 
requests from the virus scan request queue to the virus checkers, each anti-virus scan 
request on the virus scan request queue being serviced by a respective one of the 
threads in the pool of threads. 

("The scanner thread determines whether the object of the intercepted event... needs 
scanning and, if so, scans the object Multiple scanner threads are typically provided in pools 
that are capable of executing concurrently" Column 2, lines 18-24) 

Regarding Claim 21, 

Edwards and Novell teach the virus checking system as claimed in claim 16. 
Edwards teaches certain scan requests are given priority based on certain 
characteristics by not inhibiting a first kind of scan requests while inhibiting the 
placement of a second kind of scan requests based on a second group of 
characteristics when the number of anti-virus scan requests on the virus scan request 
queue reaches a threshold, ("a pending scan request from user A may be determined to be 
more suitable than a pending scan request from user B if three of the four scanner threads are 
already scanning scan requests from user B. This prevents a single user B from monopolizing 
the virus scanner (Column 5, lines 66-67, Column 6, lines 1-3)." 

However Edwards does not explicitly teach that on-access scan requests are 
given priority over the on-demand anti-virus scan requests by inhibiting placing on- 
demand scan requests into the scan request queue. 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the method of Edwards to include prioritizing based on the type of 
virus scan (on-access or on-demand) instead of based on User type. 

The motivation is the different types of scans are an important characteristic of 
scans, and as both on-access and on-demand virus scans each have their own 
benefits, it would be useful to prioritize based on their type. 



Regarding Claims 22 and 23, 

Edwards and Novell teach a virus checking system as claimed in claim 16. 
Edwards also teaches grouping individual scan requests into chunks, and placing the 
chunks onto the virus scan request queue. Edwards further teaches scanning one type 
of grouped scans until completion before scanning a second type ("the scan request is 
placed on the priority queue in... some other pre-defined fixed order, e.g. executable files first 
and data files second" Column 7, lines 33-34, Edwards). The Examiner interprets the fixed 
order as inherently requiring grouping different scan characteristics into groups or 
chunks. 

Edwards does not explicitly teach that the scan requests would be grouped into 
chunks are on-demand scan requests. 
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It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Edwards to group on-demand scan requests into chunks. 

The motivation is that Edwards already groups scan requests into chunks based 
on certain characteristics and the type of virus scan (on-demand or on-access) is a 
characteristic of a virus scan. 

The Examiner interprets the original claim language "grouping the on-demand 
anti-virus scan requests into chunks of multiple ones of the on-demand anti-virus scan 
requests" as just "grouping individual on-demand requests into chunks." 

The Examiner further interprets inhibiting the placement of at least one of the 
chunks onto the virus scan request queue until completion of anti-virus scanning for the 
anti-virus scan requests in a prior one of the chunks as scanning one type of grouped 
scans until completion before scanning a second type. 

Regarding Claims 24-26 

Edwards teaches a virus checking system comprising: 
A plurality of virus checkers ("Virus scanners may be invoked on-demand by a 
computer user to scan a selected file. More typically, virus scanners install themselves as part 
of an operating system and then scan files, according to user preferences, as the files are 
created and accessed. This type of virus scanner is referred to as an on-access virus scanner" 
Column 1, lines 43-48), 
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a file server coupled to the virus checkers for sending virus scan requests to the 
virus checkers, ("pre-processor threads obtain certain additional characteristics about the 
scan requests... In a client/server environment, the characteristics may further include whether 
the object is being accessed form the server console or from a network client" Column 5, lines 
25-38) 

A virus scan request queue (Fig. 2, Priority Queue)] 

The file server is capable of distributing anti-virus scan requests from the virus 
scan request queue to the virus checkers. ("The scan requests are placed on the priority 
queue as they are received; the scanner threads can then select a suitable scan request from 
the priority queue based on the scab request's characteristics and the current state of the other 
scanner threads in the pool" Column 3, lines 19-23) 

each anti-virus scan request on the virus scan request queue being serviced by a 
respective one of the threads in the pool of threads, {"The scanner thread determines , 
whether the object of the intercepted event... needs scanning and ,ifso, scans the object. 
Multiple scanner threads are typically provided in pools that are capable of executing 
concurrently" Column 2, lines 18-24) 

Edwards also teaches grouping individual scan requests into chunks, and placing 
the chunks onto the virus scan request queue. Edwards further teaches scanning one 
type of grouped scans until completion before scanning a second type ("the scan 
request is placed on the priority queue in., .some other pre-defined fixed order, e.g. executable 
files first and data files second" Column 7, lines 33-34, Edwards). The Examiner interprets 
the fixed order as inherently requiring grouping different scan characteristics into 
groups or chunks. 
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Although Edwards does teach both on-demand and on-access virus scan 
requests ("Virus scanners may be invoked on-demand by a computer user to scan a selected 
file. More typically, virus scanners install themselves as part of an operating system and then 
scan files, according to user preferences, as the files are created and accessed. This type of 
virus scanner is referred to as an on-access virus scanner" Column 1, lines 43-48), Edwards 
does not explicitly teach wherein the scan request queue has on-demand anti-virus 
scanning concurrent with on-access anti-virus scanning. 

Novell teaches that "Command Anti-Virus with F-PROT Professional 4.52 for NetWare 
offers analysis, which includes both an on-access scanner and an on-demand scanner to 
search for polymorph addition, you can configure multiple concurrent scans (pg. 1)" 

It would have been obvious to one of ordinary skill in the art to combine the virus 
scan queue of Edwards to include concurrent on-access and on-demand scanners. 

The motivation to combine is that it is well known in the virus scanning art to 
have both on-demand and on-access scanners running concurrently. Novell provides 
an example of such a system. 

The Examiner interprets the "user to scan a selected file" from the Edwards 
reference as a system administrator requesting a scan of files. 
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Edwards does not explicitly teach that the scan requests would be grouped into 
chunks are on-demand scan requests. 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify Edwards to group on-demand scan requests into chunks. 

The motivation is that Edwards already groups scan requests into chunks based 
on certain characteristics and the type of virus scan (on-demand or on-access) is a 
characteristic of a virus scan. 

The Examiner interprets the original claim language "grouping the on-demand 
anti-virus scan requests into chunks of multiple ones of the on-demand anti-virus scan 
requests" as just "grouping individual on-demand requests into chunks." 

The Examiner further interprets inhibiting the placement of at least one of the 
chunks onto the virus scan request queue until completion of anti-virus scanning for the 
anti-virus scan requests in a prior one of the chunks as scanning one type of grouped 
scans until completion before scanning a second type. 

Regarding Claims 27 and 28, 

Edwards teaches the virus checking system as claimed in claim 24/ Edwards 
discloses changing the priority of certain scans when a threshold is reached and 
allowing others when the same threshold is reached. Edwards writes "a pending scan 
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request from user A may be determined to be more suitable than a pending scan request from 
user B if three of the four scanner threads are already scanning scan requests from user B. 
This prevents a single user B from monopolizing the virus scanner (Column 5, lines 66-67, 
Column 6, lines 1-3)." 

Edwards also teaches grouping individual scan requests into chunks, and placing 
the chunks onto the virus scan request queue. Edwards further teaches scanning one 
type of grouped scans until completion before scanning a second type ("the scan 
request is placed on the priority queue in... some other pre-defined fixed order, e.g. executable 
files first and data files second" Column 7, lines 33-34, Edwards). The Examiner interprets 
the fixed order as inherently requiring grouping different scan characteristics into 
groups or chunks. 



Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Harris C. Wang whose telephone number is 
5712701462. The examiner can normally be reached on M-F 8-5:30, Alternate Fridays 
Off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, AYAZ R. SHEIKH can be reached on (571)272-3795. The fax phone 
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number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



HCW 




